<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
 <head>
  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <title>Sessions and security</title>

 </head>
 <body><div class="manualnavbar" style="text-align: center;">
 <div class="prev" style="text-align: left; float: left;"><a href="session.upload-progress.html">Session Upload Progress</a></div>
 <div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session 函数</a></div>
 <div class="up"><a href="book.session.html">Sessions</a></div>
 <div class="home"><a href="index.html">PHP Manual</a></div>
</div><hr /><div id="session.security" class="chapter">
 <h1>Sessions and security</h1>

 <p class="para">
  External links: <a href="http://www.acros.si/papers/session_fixation.pdf" class="link external">&raquo;&nbsp;Session fixation</a>
 </p>
 <p class="para">
  The session module cannot guarantee that the information you store
  in a session is only viewed by the user who created the session. You need
  to take additional measures to actively protect the integrity of the
  session, depending on the value associated with it.
 </p>
 <p class="para">
  Assess the importance of the data carried by your sessions and deploy
  additional protections -- this usually comes at a price, reduced
  convenience for the user.  For example, if you want to protect users from
  simple social engineering tactics, you need to enable
  <em>session.use_only_cookies</em>.  In that case,
  cookies must be enabled unconditionally on the user side, or
  sessions will not work.
 </p>
 <p class="para">
  There are several ways to leak an existing session id to third parties.
  A leaked session id enables the third party to access all resources which
  are associated with a specific id.  First, URLs carrying session ids.  If
  you link to an external site, the URL including the session id might be
  stored in the external site&#039;s referrer logs. Second, a more active
  attacker might listen to your network traffic. If it is not encrypted,
  session ids will flow in plain text over the network. The solution here
  is to implement SSL on your server and make it mandatory for users.
 </p>
</div>
<hr /><div class="manualnavbar" style="text-align: center;">
 <div class="prev" style="text-align: left; float: left;"><a href="session.upload-progress.html">Session Upload Progress</a></div>
 <div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session 函数</a></div>
 <div class="up"><a href="book.session.html">Sessions</a></div>
 <div class="home"><a href="index.html">PHP Manual</a></div>
</div></body></html>
